kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Add SYS_CHROOT cap to unprivileged containers

Browse source 
Fixes #6103
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-06-02 18:23:47 -07:00
parent f65fadbda0
commit 41f7cef2bd
2 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
daemon/execdriver/native/template/default_template.go
View file

@ -20,6 +20,7 @@ func New() *libcontainer.Container {
"SETFCAP",
"SETPCAP",
"NET_BIND_SERVICE",
"SYS_CHROOT",
},
Namespaces: map[string]bool{
"NEWNS": true,

12
integration-cli/docker_cli_run_test.go
View file

@ -873,3 +873,15 @@ func TestThatCharacterDevicesActLikeCharacterDevices(t *testing.T) {
logDone("run - test that character devices work.")
}
func TestRunUnprivilegedWithChroot(t *testing.T) {
cmd := exec.Command(dockerBinary, "run", "busybox", "chroot", "/", "true")
if _, err := runCommand(cmd); err != nil {
t.Fatal(err)
}
deleteAllContainers()
logDone("run - unprivileged with chroot")
}